Good ideas.
What about (re)-mount with nosuid [among other useful mount options]?
Edit by Patrick:
Created (re-)mount home [and other?] with noexec (and nosuid [among other useful mount options]) for better security? for it.
1 Like